PostgreSQL `to_char()` Overflow Enables Authenticated Remote Code Execution

A proof of concept is available for CVE-2026-14669, a CVSS 8.8 heap-based buffer overflow in PostgreSQL's to_char(timestamptz) date/time formatting path. Improper validation of session timezone-abbreviation length permits an authenticated attacker able to set the session timezone over a normal SQL connection to corrupt memory in the database server process, potentially causing denial of service or executing code as the operating-system account that runs PostgreSQL.

Published exploit details describe using the overflow to disclose heap and PIE-base pointers, forge a MemoryContextCallback, and invoke system during MemoryContextReset() cleanup. PostgreSQL versions 14 through 18 are affected before their respective fixed releases; organizations should identify exposed instances and promptly upgrade to the patched versions in the vendor security bulletin, particularly where untrusted users can establish SQL sessions or alter session settings.